Syscall Auditing at Scale

This post introduces go-audit, an open-source userspace daemon that replaces the traditional auditd. It addresses the challenges of parsing multiline, interleaved, and out-of-order auditd logs by converting them into single JSON blobs. go-audit communicates directly with the Linux kernel via netlink for performance and minimal filtering on hosts. The post explains the Linux Audit system, demonstrates its usage with `auditctl` for file access and network listen syscalls, and argues for centralized analysis of all syscalls rather than host-level filtering to improve security and forensic capabilities. It also provides an FAQ addressing choices like auditd over sysdig/osquery, alert handling, log volume, rsyslog usage, and canary validation.